CVE-2026-0257
PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
In short
Palo Alto Networks PAN-OS has a flaw in its GlobalProtect VPN system that allows attackers to bypass login requirements and connect to the network without proper authentication. This is dangerous because it gives unauthorized access to corporate resources.
Technical detail
Authentication bypass vulnerability in PAN-OS GlobalProtect portal and gateway (CWE-565) allows unauthenticated attackers to establish unauthorized VPN connections by circumventing security restrictions. The attack requires network access to the GlobalProtect interface but no valid credentials; successful exploitation grants unauthorized access to protected network resources. Panorama and Cloud NGFW deployments are not affected.
Summary generated and translated by AI from the official description.
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.
Panorama and Cloud NGFW are not impacted by these issues.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red
Affected products
Palo Alto Networks · Cloud NGFWPalo Alto Networks · PAN-OSPalo Alto Networks · Prisma Accesspublic PoCs found — 10
githubgithub.com/sfewer-r7/CVE-2026-0257★ 24githubgithub.com/tushargurav28/CVE-2026-0257★ 3githubgithub.com/0xBlackash/CVE-2026-0257★ 3githubgithub.com/akashsingh0454/CVE-2026-0257-PoC★ 2githubgithub.com/grayxploit/CVE-2026-0257★ 1githubgithub.com/Mr-Robot-LP/CVE-2026-0257★ 1githubgithub.com/Ez4rd1x1/CVE-2026-0257★ 0githubgithub.com/HORKimhab/CVE-2026-0257★ 0githubgithub.com/bolubey/CVE-2026-0257★ 0githubgithub.com/jenniferreire26/CVE-2026-0257★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →